The ShortPixel Image Optimizer plugin for WordPress versions up to 5.6.3 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw enables a blind SQL injection attack vector, potentially allowing an attacker with high privileges to extract sensitive information from the database without user interaction. The vulnerability is network exploitable with low attack complexity but requires high privileges and no user interaction. The impact includes high confidentiality loss and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive database information due to blind SQL injection. The vulnerability does not directly allow modification or destruction of data but can impact confidentiality significantly. Availability impact is low. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and limit high privilege accounts to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.